Friday, March 29, 2024

Threat Actors Exploit Microsoft ‘Follina’ Bug to Attack Europe and U.S. Entities

The recently disclosed vulnerability in Microsoft Office, known as Follina has been exploited by state-sponsored hackers. They did so to target the alleged entities from the following regions:-

  • Europe
  • The U.S.

On May 31, Microsoft released workarounds for a zero-day vulnerability that has been discovered recently and known as “Follina.” 

At the time of its discovery, this vulnerability didn’t receive the tracking number. However, this time the tracking number of this vulnerability has been assigned:-

  • CVE-2022-30190 with CVSS score 7.8

Here’s what the advisory published by Microsoft states:-

“Recently, Microsoft released a security bulletin regarding a vulnerability related to the Microsoft Support Diagnostic Tool (MSDT) in Windows, which it assigned the CVE-2022-30190.”

Attack chain

It should be noted that MSDT uses the URL protocol when interacting with a calling application like Word, thereby posing a remote code execution vulnerability. 

When this vulnerability is exploited, a successful attacker will be able to execute arbitrary code with full privileges as if the calling application was themselves. 

In the context allowed by the user’s rights, the attacker can at this point install programs, create accounts, view, edit, delete data, or change data that has been stored.

Having sent more than 1,000 phishing emails containing a lure document, what makes this attack far more devastating. An RTF (242d2fa02535599dae793e731b6db5a2) containing the exploit payload was used in this campaign that masqueraded as a salary increase and connected to 45.76.53[.253] for downloading the exploit payload.

Payloads, which are manifested as PowerShell scripts, are Base64-encoded so that they are transmissible. This PowerShell script is being downloaded from a remote server called “seller-notification[.]live,” in short, this script functions as a downloader.

In a recent report, Proofpoint researchers have claimed that the China-linked APT group TA413 generally uses the weaponized Word documents with ZIP archives against spear-phishing victims.

In the attacks, the attackers use the domain tibet-gov.web[.]app in order to simulate the Women Empowerments Desk of the “Central Tibetan Administration.”

With exploits for the Follina vulnerability, less than 10 Proofpoint customers from the European and local US governments have been targeted.

At the present time, the exploit mainly affects the older versions of Microsoft Office: – 

  • Microsoft Office 2013
  • Microsoft Office 2016

While the further investigation indicates that the flaw affects even the latest versions of Microsoft Office as well.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles